Nearly 29 million servers still run vulnerable versions of PHP almost two weeks after emergency patches were released, according to Kaspersky, leaving a large share of the web exposed to flaws that can let attackers run code on a server without logging in.

The figures come from internet scanning data collected by Censys and cited by Kaspersky in an assessment published on 3 November. Of about 46 million scannable servers running a vulnerable PHP version, 29 million still contain the flaws, the company said.

The flaws at the centre of the warning, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, were disclosed in late October. They could let an attacker execute code on a server remotely, without authentication, and potentially affected about 70 percent of websites worldwide, according to figures cited by Kaspersky. PHP's developers released emergency patches on 21 October for the supported PHP 8.2 to 8.5 branches and for the unsupported 7.4, 8.0 and 8.1 branches.

Experts had predicted attacks would begin within 15 minutes of the patches going public, and Amazon reported exploitation attempts four days before the patches were even released. Several governments took precautions, with government service websites in some countries taken offline, and Wikipedia's project management and bug-tracking system suspending service.

The first solid confirmation of real-world exploitation came on 24 October, when honeypot servers run by a researcher at Perplexity recorded successful attacks from two IP addresses. The honeypots ran PHP 8.4.26 with the Apache mod_php module, a configuration Kaspersky notes is the most convenient for attackers, and the observed exploit chain matched CVE-2026-109618. Two days later, the US Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalogue, confirming the threat was not only theoretical.

There have also been confirmed breaches. On 26 October, the technology company Dream reported that 25 firewalls and management servers had been compromised in the United States, Japan, Taiwan and South Korea, three of them in an environment presumed to be linked to US government agencies. The attackers combined PHP2Shell with a Linux kernel flaw known as Fragnesia, tracked as CVE-2026-46300, gaining full administrative control and extracting a service account password, user and group listings, network configuration and private keys.

Dream initially did not name the device vendor, but said in an update on 29 October that the systems were Palo Alto Networks devices running certain versions of its PAN-OS software. The vendor confirmed attacks on management interfaces exposed to the internet and urged customers to close public access to those interfaces, restrict it to trusted internal addresses and install patches.

Despite all this, no wave of mass breaches has materialised. Kaspersky says the scale of even the Palo Alto case was small: of about 19,000 devices identified, the attackers picked just 240 that ran software versions their exploit could handle. The existing PHP2Shell exploits are not one-size-fits-all, because an attacker must account for the exact PHP build, memory settings, request handling and application details of each target. The danger remains, however, and the company says patching alone is not enough: organisations should also audit their systems for signs of compromise.

There is a second patching problem running alongside PHP2Shell. Five days after the emergency patches, PHP published another round of fixes for a flaw in Brotli, a third-party compression library bundled with its Windows packages. The flaw, tracked as CVE-2026-111497 and scored 9.2 out of 10, or Critical, by Google, can lead to code execution when PHP processes a specially crafted compressed response from an external server through its cURL extension.

The rebuilt Windows packages, labelled 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, bundle the fixed Brotli 1.2.1 instead of the flawed 1.2.0. They are easy to miss, because the PHP version number reported by the software does not change at all: only the minus-one suffix in the package name and its SHA-256 hash distinguish the fixed builds. The flaw is also reachable by default through Guzzle, a widely used PHP HTTP client library, which turns on automatic response decompression unless told otherwise.

CISA added CVE-2026-111497 to its exploited-vulnerabilities catalogue on 27 October, with a remediation deadline for US federal civilian agencies of 10 November. Attacks reported so far have targeted Node.js rather than PHP, and no public exploit against PHP has been found, but the first attack exploiting the flaw was recorded on 26 October. The advice is to install the rebuilt packages, verify them by filename or hash rather than by version number, and, until updated, switch off automatic decompression for requests to untrusted servers.